topic PIX implicit permit rule in Network Security

PIX implicit permit rule

wwbarnes — Sat, 22 Feb 2020 07:15:21 GMT

I have the need to remove the implicit permit rule on a PIX 501, can this be done?

Re: PIX implicit permit rule

gonzalez-j — Wed, 08 Jun 2005 18:49:22 GMT

Just apply an access list to the interface as follows:

access-list inside deny ip any any

access-group inside in interface inside

By default, when you apply an access list to any interface there is an implied "deny ip any any". However, I like to actually put it inside the access list so I can see it.

Remember, if you add a rule to the access list, the rule gets placed below the "deny ip any any". So you must always execute the following to make your rule active:

no access-list inside deny ip any any

access-list inside deny ip any any

Re: PIX implicit permit rule

mjsully — Wed, 08 Jun 2005 19:28:48 GMT

If you are running a current version of the code, you don't have to take out the deny access-list and put it back in. You can just insert the access-list on what line you specify. This lets you put it above the deny statement.

access-list inside permit line 1 host x.x.x.x host y.y.y.y